Network intrusion detection systems (NIDS) are considered an effective defence against network-based attacks directed at computer systems and are employed in almost all large-scale IT infrastructures, due to the increasing severity and likelihood of such attacks. There are two main types of intrusion detection systems: signature-based and anomaly-based intrusion detection systems.
A signature-based intrusion detection systems (SBS) relies on pattern-matching techniques. The system contains a database of signatures, i.e. sequences of data, that are known from attacks of the past. These signatures are matched against the analyzed data. When a match is found, an alarm is raised. The database of signatures needs to be updated by experts after a new attack has been identified.
Differently, an anomaly-based intrusion detection systems (ABS) first build a statistical model describing the normal network traffic. The system then analyses data and flags any traffic or action that significantly deviates from the model, as an attack. The advantage of an anomaly-based system is that it can detect zero-day attacks, i.e. attacks that not yet have been identified as such by experts.
An SBS can detect not only when there is an attack, but can also classify the attack and provide information about the attack, since this information is usually provided in the database. An attack classification may identify the attack context with respect to the vulnerability exploited and the target. Typical examples of attack classifications are: buffer overflow, SQL Injection, Cross-site Scripting, path traversal, port scan and service fingerprinting.
These high-level classifications are often used by security teams to choose an appropriate counter measure policy or action, since attacks of a certain attack class may be more harmful than others. For instance, if a buffer overflow class alert is raised, the policy may be that the system will immediately deny any further communication to a certain IP, while in case of a port scan class alert, the system may wait for further action to take place.
An ABS generates and provides an attack alert when the currently analysed traffic data is too different from the model of normal traffic. Security teams have to manually inspect each alert raised by the ABS to choose an appropriate counter measure policy or action, which results in a workload for the security team members. Several systems have been proposed to lower the workload for the security team members when alerts are raised by an ABS.
The US patent application US2007/0118905 describes a method for automatically classifying a set of alarms on the basis of specific trellis of the alerts. The specific trellis are merged into general trellis. Collated alerts are identified by selecting the alerts that are simultaneously the most pertinent and the most general. The collated alerts are supplied to an output unit of an alert management system.
In an article by W. Robertson et al., “Using generalisation and characterization techniques in the anomaly-based detection of web attacks” (conference proceeding NDSS symposium 2006), an anomaly based detection system of web-based attacks is disclosed. The system uses an anomaly generalization technique that automatically translates suspicious web requests into anomaly signatures. These signatures are then used to group recurrent or similar anomalous requests so that an administrator can easily deal with a large number of similar alerts. The grouping of signatures is done using ad hoc heuristics.